渗透测试是一种通过生成和执行可能的攻击来评估网络安全的方法。这样做可以自动进行定期和系统的测试，而无需大量的人力。一个关键问题是如何产生攻击。这自然是一个规划问题。以前的工作（Lucangeli et al. 2010）使用经典规划，因此忽略了所有黑客特有的不完整知识。最近的工作（Sarraute等人，2011）为了扩展而做出了强有力的独立性假设，并且缺乏关于攻击规划问题实际上是什么的明确的正式概念。在这里，我们模型的部分可观察马尔可夫决策过程（POMDP）的问题。这是渗透测试在一个良好的研究形式主义的基础，突出了这个问题的性质的重要方面。POMDPs允许将信息收集建模为问题的一个组成部分，从而首次提供了一种智能地将扫描操作与实际利用混合在一起的方法。
英文摘要：
Penetration Testing is a methodology for assessing network security, by generating and executing possible attacks. Doing so automatically allows for regular and systematic testing without a prohibitive amount of human labor. A key question then is how to generate the attacks. This is naturally formulated as a planning problem. Previous work (Lucangeli et al. 2010) used classical planning and hence ignores all the incomplete knowledge that characterizes hacking. More recent work (Sarraute et al. 2011) makes strong independence assumptions for the sake of scaling, and lacks a clear formal concept of what the attack planning problem actually is. Herein, we model that problem in terms of partially observable Markov decision processes (POMDP). This grounds penetration testing in a well-researched formalism, highlighting important aspects of this problem's nature. POMDPs allow to model information gathering as an integral part of the problem, thus providing for the first time a means to intelligently mix scanning actions with actual exploits.
Evaluation of Reinforcement Learning for Autonomous Penetration Testing using A3C, Q-learning and DQN
German Research Center for Artificial Intelligence (DFKI)（德国人工智能研究中心）；OPS-GDA, ESA-ESOC（欧洲空间操作中心（ESA-ESOC）OPS-GDA部门）；Technische Universität Kaiserslautern（凯泽斯劳滕工业大学）
Modeling Penetration Testing with Reinforcement Learning Using Capture-the-Flag Challenges: Trade-offs between Model-free Learning and A Priori Knowledge
Pentest-R1: Towards Autonomous Penetration Testing Reasoning Optimized via Two-Stage Reinforcement Learning
State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences（中国科学院网络空间安全防御重点实验室，信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络与安全学院）
AutoPT: How Far Are We from the End2End Automated Web Penetration Testing?
University of Science and Technology of China（中国科学技术大学）；QI-ANXIN Technology Research Institute（奇安信技术研究院）；Chaitin Future Technology Co., Ltd（观想未来科技有限公司）
PentestEval: Benchmarking LLM-based Penetration Testing with Modular and Stage-Level Design
School of Computing and Information Systems, Singapore Management University（计算与信息系统学院，新加坡国立管理大学）；School of Computer Science and Engineering, Nanyang Technological University（计算机科学与工程学院，南洋理工大学）；School of Cyber Security, Tianjin University（网络安全学院，天津大学）
Staying on the Attack Path: Structured State for Long-Horizon Automated Penetration Testing
Tianjin University（天津大学）；Changchun University of Science and Technology（长春理工大学）；Jilin Province Key Laboratory of Network and Information Security（吉林省网络与信息安全重点实验室）；Shihezi University（石河子大学）
Decoupling Reconnaissance and Exploitation: Measuring the Capability Boundaries of LLM-Based Web Penetration Testing
University of Science and Technology of China（中国科学技术大学）；Suzhou Institute for Advanced Research, University of Science and Technology of China（中国科学技术大学苏州先进研究院）；Nanjing University of Science and Technology（南京理工大学）；Research Institute, Runjian Co., Ltd（润杰有限公司研究院）
From Capabilities to Performance: Evaluating Key Functional Properties of LLM Architectures in Penetration Testing
Bradley Department of Electrical and Computer Engineering, Virginia Tech（弗吉尼亚理工大学电气与计算机工程系布雷拉德部门）；National Security Institute, Virginia Tech（弗吉尼亚理工大学国家安全研究所）
Environment-Grounded Multi-Agent Workflow for Autonomous Penetration Testing
JOANNEUM RESEARCH Forschungsgesellschaft mbH, DIGITAL – Institute for Digital Technologies（JOANNEUM RESEARCH 研究所，DIGITAL – 数字技术研究所）；TU Graz, Institute for Technical Informatics（格拉茨技术大学，技术信息研究所）；Jamk University of Applied Sciences, Institute of Information Technology（贾马克应用科学大学，信息技术研究所）
Hackers or Hallucinators? A Comprehensive Analysis of LLM-Based Automated Penetration Testing
School of Cyber Science and Engineering, Sichuan University（四川大学网络空间安全学院）；Institute for Network Sciences and Cyberspace, Tsinghua University（清华大学网络科学与网络空间研究院）；College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）；National University of Singapore（新加坡国立大学）；College of Electronic Engineering, National University of Defense Technology（国防科技大学电子工程学院）；Gaoling School of Artificial Intelligence, Renmin University of China（中国人民大学高瓴人工智能学院）；School of Artificial Intelligence, Wuhan University（武汉大学人工智能学院）
Agentic Security: A Systematization of Tools, Failure Modes, and Design Laws for LLM-Driven Penetration Testing
Ahsanullah University of Science and Technology（阿赫桑乌拉科技大学）；BRAC University（BRAC大学）；North South University（北南大学）；Missouri State University（密苏里州立大学）；Multimedia University（多媒体大学）；American International University-Bangladesh（孟加拉国美国国际大学）
